Skip to content

Conversation

@eholk
Copy link
Contributor

@eholk eholk commented Oct 31, 2025

Potential fix for https://github.com/microsoft/stackfuture/security/code-scanning/2

To address this issue, we should add the minimal required permissions key to the workflow. Since neither the build nor the miri job requires anything beyond reading repository contents (for checking out code to build/test), we set contents: read as the global permissions. The most efficient and maintainable fix is to add the permissions property at the root of the workflow file (just after the name: and before the jobs section), so it applies to all jobs. No changes to imports or job steps are needed.

Specifically, edit .github/workflows/rust.yml:

  • Insert a top-level permissions: block directly after the name: Rust line, prior to the on: block.
  • Set contents: read within this block.

No other code, imports, methods, or definitions are required for this correction.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@eholk eholk changed the title Potential fix for code scanning alert no. 2: Workflow does not contain permissions Add workflow permissions Oct 31, 2025
@eholk eholk marked this pull request as ready for review October 31, 2025 16:38
@eholk eholk merged commit 216c469 into main Oct 31, 2025
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants